Fallos del tipo CWE-89

11.910 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-32567HIGHWordPress Easy Post Duplicator Plugin <= 1.0.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-2093HIGHFlowring｜Docpedia - SQL InjectionEPSS 0.5%CVE-2025-32558HIGHWordPress Duplicate Title Checker Plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-11316MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findCategoryPage.do findCategoryPage sql injectionEPSS 0.5%CVE-2025-11311MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findTenantPage.do findTenantPage sql injectionEPSS 0.5%CVE-2025-11312MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findModulePage.do findModulePage sql injectionEPSS 0.5%CVE-2022-3059HIGHSQL injection in Schoolbox version 21.0.2, by Schoolbox Pty LtdEPSS 0.5%CVE-2026-4817MEDIUMMasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' ParametersEPSS 0.5%CVE-2024-13341MEDIUMMultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2024-11912HIGHTraveler <= 3.1.6 - Unauthenticated SQL Injection via order_idEPSS 0.5%CVE-2024-43978CRITICALWordPress Super Store Finder plugin < 6.9.8 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-4485MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-11314MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injectionEPSS 0.5%CVE-2024-33450HIGHSQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive informationEPSS 0.5%CVE-2025-53937CRITICALWeGIA has SQL Injection (Blind Time-Based) Vulnerability in `cargo` Parameter on `control.php` EndpointEPSS 0.5%CVE-2024-44004CRITICALWordPress WPCargo Track & Trace plugin <= 8.0.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-11315MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findUserPage.do findUserPage sql injectionEPSS 0.5%CVE-2025-11310MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findFileServerPage.do findFileServerPage sql injectionEPSS 0.5%CVE-2024-55984HIGHWordPress Saksh Escrow System plugin <= 2.4 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-32681HIGHWordPress Error Log Viewer By WP Guru plugin <= 1.0.5 - SQL Injection vulnerabilityEPSS 0.5%